  ============================================================================
                               Dr.Web Anti-Virus Solution
                                    v. 11.1.4
                          drweb-nss - NSS volumes monitor
  ============================================================================


drweb-nss  is  a monitor  of  volumes  with  NSS (Novell Storage Services)  file
system.  This component is designed for monitoring modifications of files in the
NSS file system.  It operates in the resident mode  and monitors general actions
in the file system  that relate  to  files and directories  (creation,  opening,
closing).  When the component intercepts such events, it checks whether the file
was changed, and if so, the monitor creates a task to scan this file.  This task
is sent to the drweb-se component.  Another feature  of this monitor  is that it
manages its own, separate, quarantine for threats detected on NSS volumes.

This  monitor  controls  only  the volumes  which are specified  in the settings
(NssVolumesMountDir  and  ProtectedVolumes  parameters).  The monitor  does  not
detect automatically, when a new NSS file system volume is mounted or unmounted.
You can disable the component to monitor certain files and directories. That can
be useful if certain files are frequently modified,  which causes the monitor to
frequently check them and thus increases the system load.  So,  if it is typical
for certain files  to be  frequently changed,  you can exclude these files  from
monitoring  (recommended).  In  this  case,  the  monitor  does  not  respond to
modification of the excluded files.

NSS volumes monitor has the following feature: if a threat is detected in a file
upon its copying (to a protected volume or within an NSS volume),  it marks only
the copy  of  the infected file.  The threat  in the original  file  will not be
detected.  This file  will be  considered safe  until  an attempt to access this
(original) file  is performed or until it is modified  if the file resides on an
NSS volume.

If  Quarantine action  is specified  for some threat type in NSS volumes monitor
settings,  the object  containing  a  threat  of this type  will  be  placed  to
quarantine  again on attempt to restore  this object  from quarantine  to an NSS
volume. For example, the following default settings
 NSS.OnKnownVirus = Cure
 NSS.OnIncurable = Quarantine
move all incurable objects to quarantine.  At that, when any incurable object is
restored from quarantine to an NSS volume, this object is automatically returned
to quarantine.


For  additional  information,   refer   to  the  User  Manual   (placed  to  the
/opt/drweb.com/share/doc directory) or visit the official company website.


Doctor Web, 1992-2022.
Russian Federation, Moscow - Saint-Petersburg.
http://www.drweb.com/